CVE-2024-39227

CRITICAL
Published Aug 6, 2024 Modified Aug 15, 2024 CWE-74 CWE-75

Description

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-74 CWE-74
CWE-75 CWE-75

Affected Products

Vendor Product
gl-inet mt6000_firmware
gl-inet mt6000
gl-inet a1300_firmware
gl-inet a1300
gl-inet x300b_firmware
gl-inet x300b
gl-inet ax1800_firmware
gl-inet ax1800
gl-inet axt1800_firmware
gl-inet axt1800
gl-inet mt2500_firmware
gl-inet mt2500
gl-inet mt3000_firmware
gl-inet mt3000
gl-inet x3000_firmware
gl-inet x3000
gl-inet xe3000_firmware
gl-inet xe3000
gl-inet xe300_firmware
gl-inet xe300
gl-inet e750_firmware
gl-inet e750
gl-inet x750_firmware
gl-inet x750
gl-inet sft1200_firmware
gl-inet sft1200
gl-inet ar300m_firmware
gl-inet ar300m
gl-inet ar300m16_firmware
gl-inet ar300m16
gl-inet ar750_firmware
gl-inet ar750
gl-inet ar750s_firmware
gl-inet ar750s
gl-inet b1300_firmware
gl-inet b1300
gl-inet mt1300_firmware
gl-inet mt1300
gl-inet mt300n-v2_firmware
gl-inet mt300n-v2
gl-inet ap1300_firmware
gl-inet ap1300
gl-inet b2200_firmware
gl-inet b2200
gl-inet mv1000_firmware
gl-inet mv1000
gl-inet mv1000w_firmware
gl-inet mv1000w
gl-inet usb150_firmware
gl-inet usb150
gl-inet sf1200_firmware
gl-inet sf1200
gl-inet n300_firmware
gl-inet n300
gl-inet s1300_firmware
gl-inet s1300

References

Frequently Asked Questions

What is CVE-2024-39227? +
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2024-39227? +
CVE-2024-39227 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2024-39227? +
CVE-2024-39227 affects products from gl-inet, specifically: a1300, a1300_firmware, ap1300, ap1300_firmware, ar300m, ar300m16, ar300m16_firmware, ar300m_firmware, ar750, ar750_firmware, ar750s, ar750s_firmware, ax1800, ax1800_firmware, axt1800, axt1800_firmware, b1300, b1300_firmware, b2200, b2200_firmware, e750, e750_firmware, mt1300, mt1300_firmware, mt2500, mt2500_firmware, mt3000, mt3000_firmware, mt300n-v2, mt300n-v2_firmware, mt6000, mt6000_firmware, mv1000, mv1000_firmware, mv1000w, mv1000w_firmware, n300, n300_firmware, s1300, s1300_firmware, sf1200, sf1200_firmware, sft1200, sft1200_firmware, usb150, usb150_firmware, x3000, x3000_firmware, x300b, x300b_firmware, x750, x750_firmware, xe300, xe3000, xe3000_firmware, xe300_firmware. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-39227? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-39227 — free, no signup required.

Start Free Scan